Iso 22301 (business continuity) checklist

Document everything required by the standard (there’s 
a list at the end of this checklist) and anything else you 
think necessary. Control the changes to your documents:
NQA/BCMS/Checklist/FEB21
ISO 22301:2019 MANDATORY DOCUMENTS
CLAUSE
DOCUMENT
CLAUSE
DOCUMENT
4.2.2
Applicable legal requirements, regulations or laws, and any 
other identified requirements
8.4.2.4
Documented procedures for each response team
4.3.1
The scope of the BCMS
8.4.3.1
Warning and communication procedures
4.3.2
Exclusions from the scope of the BCMS
8.4.4.1
Business continuity plans
5.2.2
The Business Continuity Policy
8.4.5
Recovery and restoration processes
6.2.1
Business Continuity objectives
8.5
Post-exercise reports
7.2
Evidence of personnel competence
9.1
Results of monitoring, measurement, analysis and 
evaluation of the performance of the BCMS
7.5.1
Documentation required by the standard (this list) and 
anything else considered necessary for the effectiveness of 
the BCMS
9.2.2
Evidence of the implementation of the audit programme 
and the audit results
8.1
Information necessary to have confidence that the 
operational planning and control processes are being 
carried out as planned
9.3.3.2
Results of the management reviews
8.4.1
Business continuity plans and procedures
10.1.3
The nature of non-conformities and what was done about 
them, and the results of the corrective action

---

Page 3 
When bad things happen, it can be 
immediately or over a period. The 
consequences can continue for some 
time after. 
You need to know what’s important 
to the organization, what are the 
consequences of their disruption over 
time, and how long you can tolerate 
it. You work this out with a Business 
Impact Analysis (BIA).